允许 CloudFront 使用源访问身份访问 S3 存储桶

Question

我创建了一个托管由 CloudFront 提供的 S3 存储桶的静态网站。我想仅通过源访问身份直接从 CloudFront 限制存储桶访问。

我尝试更新 S3 存储桶策略，但它显示错误：

Error putting S3 policy: MalformedPolicy: Invalid principal in policy status code: 400, request id

我正在尝试使用以下策略：

resource "aws_s3_bucket_policy" "default" {
bucket = "${aws_s3_bucket.default.id}"
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "2",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${aws_cloudfront_origin_access_identity.origin_access_identity.id}"
},
"Action": "s3:*",
"Resource": "arn:aws:s3:::$/*"
}
]
}
EOF 
}

Answer 1

如 [aws_cloudfront_origin_access_identity 文档] 1 中所述，执行此操作的最佳方法是生成 IAM 策略文档 使用aws_iam_policy_document数据源，然后直接附加该数据源。

示例如下所示：

data "aws_iam_policy_document" "s3_policy" {
statement {
actions   = ["s3:GetObject"]
resources = ["${module.names.s3_endpoint_arn_base}/*"]
principals {
type        = "AWS"
identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
}
}
statement {
actions   = ["s3:ListBucket"]
resources = ["${module.names.s3_endpoint_arn_base}"]
principals {
type        = "AWS"
identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
}
}
}
resource "aws_s3_bucket" "bucket" {
# ...
policy = "${data.aws_iam_policy_document.s3_policy.json}"
}

如果您真的想像问题中一样手工制定 IAM 策略，那么您只需要这样的东西：

resource "aws_s3_bucket_policy" "default" {
bucket = "${aws_s3_bucket.default.id}"
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "2",
"Effect": "Allow",
"Principal": {
"AWS": "${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"
},
"Action": "s3:*",
"Resource": "${aws_s3_bucket.default.arn}""
}
]
}
EOF 
}